Bug 27604 - PatronSelfRegistrationLibraryList can be bypassed
Summary: PatronSelfRegistrationLibraryList can be bypassed
Status: Pushed to oldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on: 16274
Blocks:
  Show dependency treegraph
 
Reported: 2021-02-03 15:13 UTC by Jonathan Druart
Modified: 2021-02-24 16:24 UTC (History)
12 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Text to go in the release notes:
Version(s) released in:
21.05.00,20.11.03,20.05.09,19.11.15


Attachments
Bug 27604: Make sure PatronSelfRegistrationLibraryList is used (2.45 KB, patch)
2021-02-03 15:16 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 27604: Make sure PatronSelfRegistrationLibraryList is used (2.51 KB, patch)
2021-02-03 16:40 UTC, Lucas Gass
Details | Diff | Splinter Review
Bug 27604: Make sure PatronSelfRegistrationLibraryList is used (2.62 KB, patch)
2021-02-05 17:32 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 27604: (QA follow-up) Limit the libraries during the query (1.38 KB, patch)
2021-02-05 17:32 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 27604: Init to {} (851 bytes, patch)
2021-02-08 13:43 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 27604: Deal with empty pref (996 bytes, patch)
2021-02-16 08:31 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 27604: [19.11] Make sure PatronSelfRegistrationLibraryList is used (2.71 KB, patch)
2021-02-19 07:37 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2021-02-03 15:13:50 UTC
The value of PatronSelfRegistrationLibraryList is used to display the dropdown list of the libraries, but not after the form is submitted.
Comment 1 Jonathan Druart 2021-02-03 15:16:44 UTC
Created attachment 116271 [details] [review]
Bug 27604: Make sure PatronSelfRegistrationLibraryList is used

The value of PatronSelfRegistrationLibraryList is used to display the dropdown
list of the libraries, but not after the form is submitted.

Test plan:
1. Empty PatronSelfRegistrationLibraryList
2. Self register a new patron
=> Confirm the dropdown list with the libraries contain all the
libraries
3. Fill in PatronSelfRegistrationLibraryList with branchcodes (eg. "CPL|MPL")
4. Self register a new patron
5. Edit the HTML form and replace the option's value with another
branchcode (FPL)
6. Save
=> Without this patch the branchcode FPL is used
=> With this patch applied an ugly 500 is returned
Comment 2 Lucas Gass 2021-02-03 16:40:01 UTC
Created attachment 116286 [details] [review]
Bug 27604: Make sure PatronSelfRegistrationLibraryList is used

The value of PatronSelfRegistrationLibraryList is used to display the dropdown
list of the libraries, but not after the form is submitted.

Test plan:
1. Empty PatronSelfRegistrationLibraryList
2. Self register a new patron
=> Confirm the dropdown list with the libraries contain all the
libraries
3. Fill in PatronSelfRegistrationLibraryList with branchcodes (eg. "CPL|MPL")
4. Self register a new patron
5. Edit the HTML form and replace the option's value with another
branchcode (FPL)
6. Save
=> Without this patch the branchcode FPL is used
=> With this patch applied an ugly 500 is returned

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 3 Nick Clemens 2021-02-05 17:32:05 UTC
Created attachment 116424 [details] [review]
Bug 27604: Make sure PatronSelfRegistrationLibraryList is used

The value of PatronSelfRegistrationLibraryList is used to display the dropdown
list of the libraries, but not after the form is submitted.

Test plan:
1. Empty PatronSelfRegistrationLibraryList
2. Self register a new patron
=> Confirm the dropdown list with the libraries contain all the
libraries
3. Fill in PatronSelfRegistrationLibraryList with branchcodes (eg. "CPL|MPL")
4. Self register a new patron
5. Edit the HTML form and replace the option's value with another
branchcode (FPL)
6. Save
=> Without this patch the branchcode FPL is used
=> With this patch applied an ugly 500 is returned

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

https://bugs.koha-community.org/show_bug.cgi?id=11983
Comment 4 Nick Clemens 2021-02-05 17:32:08 UTC
Created attachment 116425 [details] [review]
Bug 27604: (QA follow-up) Limit the libraries during the query

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

https://bugs.koha-community.org/show_bug.cgi?id=11983
Comment 5 Jonathan Druart 2021-02-08 13:43:44 UTC
Created attachment 116497 [details] [review]
Bug 27604: Init to {}
Comment 6 Jonathan Druart 2021-02-08 13:58:05 UTC
Pushed to master for 21.05, thanks to everybody involved!
Comment 7 Jonathan Druart 2021-02-16 08:31:06 UTC
Created attachment 116907 [details] [review]
Bug 27604: Deal with empty pref
Comment 8 Jonathan Druart 2021-02-16 09:23:18 UTC
(In reply to Jonathan Druart from comment #7)
> Created attachment 116907 [details] [review] [review]
> Bug 27604: Deal with empty pref

Patch pushed to master.
Comment 9 Victor Grousset/tuxayo 2021-02-18 20:31:03 UTC
tl;dr can't backport to 19.11, help needed with the conflicts


Thanks Andrew for testing on 20.05

As this applies without any issue on 20.05, that means my hope of using the 20.05 version to solve the conflicts won't realize. ^^"


Reply from Fridolin via email
> I see Bug 25136 affects this code, its only in >= 20.05.
> https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25136

Bug 25136 didn't introduced the bug, I can reproduce it on 19.11


> Or maybe try to apply 3 patches squashed as one. 

Same conflict :(
Comment 10 Jonathan Druart 2021-02-19 07:37:34 UTC
Created attachment 117020 [details] [review]
Bug 27604: [19.11] Make sure PatronSelfRegistrationLibraryList is used

The value of PatronSelfRegistrationLibraryList is used to display the dropdown
list of the libraries, but not after the form is submitted.

Test plan:
1. Empty PatronSelfRegistrationLibraryList
2. Self register a new patron
=> Confirm the dropdown list with the libraries contain all the
libraries
3. Fill in PatronSelfRegistrationLibraryList with branchcodes (eg. "CPL|MPL")
4. Self register a new patron
5. Edit the HTML form and replace the option's value with another
branchcode (FPL)
6. Save
=> Without this patch the branchcode FPL is used
=> With this patch applied an ugly 500 is returned

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

https://bugs.koha-community.org/show_bug.cgi?id=11983

Bug 27604: (QA follow-up) Limit the libraries during the query

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

https://bugs.koha-community.org/show_bug.cgi?id=11983

Bug 27604: Init to {}

Bug 27604: Deal with empty pref
Comment 11 Jonathan Druart 2021-02-19 07:38:41 UTC
I picked the code from master and it's working correctly it seems (ie. it embemds bug 25136).
Comment 12 Victor Grousset/tuxayo 2021-02-19 13:29:41 UTC
It works, thanks a lot Jonathan :)
Comment 13 Fridolin Somers 2021-02-23 13:36:42 UTC
Pushed to 20.11.x for 20.11.03
Comment 14 Victor Grousset/tuxayo 2021-02-23 18:09:07 UTC
Backported: Pushed to 19.11.x branch for 19.11.15
Comment 15 Jonathan Druart 2021-02-23 23:18:05 UTC
And pushed to master for 21.05